Re: Programmer DFU access

["alan shore" <SHOREA@xxxxxxxx>]

Forgive me for not replying to this before now as I have been  on a couple of 
days vaction.
Anyway, you ABSOLUTELY need to create ate least a TEST region, and maybe a QA 
region (for User acceptance testing) outside of the PRODUCTION region.
This is the environment that is on our AS/400. Like you we were hit with 2 
Audits. One internal, and one extrernal. We failed miserably. 
The results of this audit:
3 regions
Production - for obvious reasons
TEST - for development
QA - for User acceptance
Development is completed in TEST, the objects migrated to QA for user 
acceptance, and once accepted migrated to PRODUCTION.
All programming staff are in one GROUP PROFILE. All operations are in another 
Group Profile. The Users are in numerous other group profiles.
Authorization lists are created to include these group profiles. 
TEST - Programming group profile has *ALL authority to the TEST region 
libraries. Operations group profile has *ALL authority to the TEST region 
libraries. 
*PUBLIC is *EXCLUDE
QA - Programming group profile has *USE authority to the QA DATA region 
libraries. Operations group profile has *ALL authority to the QA DATA region 
libraries. The User Group Profiles have *ALL, *CHANGE or *USE authority 
(depending on their responsibility) to the QA DATA libraries. The libraries 
contatining the executables/sources *USE for all group profiles.    
*PUBLIC is *EXCLUDE
etc. etc. etc.
As you can see, the answer to your problem is very involved, and much too long 
to go into much detail here, but I hope that this points you into the right 
direction.
NOTE - careful with migrating objects from one region to another, as security 
can travel with the object from one region to another


>>> Johnny Helms <Johnny.Helms@RHTelCo.Com> 06/15 2:32 PM >>>
I am looking for suggestions on how to secure a current production AS/400 
that has programmer's using DFU to change data in files. We do have a 
development system and I thought change management would allow this 
practice to be ended. However, after talking with Aldon, they have no 
suggestions.  The reason I am trying to end this practice is due to an 
Audit we recently had that we failed miserably.

TIA,

Johnny Helms
Mid-Range Sytems Engineer

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com 
+---

+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---